scholarly journals Attack and Anomaly Detection in IoT Networks Using Supervised Machine Learning Approaches

2021 ◽  
Vol 35 (1) ◽  
pp. 11-21
Author(s):  
Himani Tyagi ◽  
Rajendra Kumar

IoT is characterized by communication between things (devices) that constantly share data, analyze, and make decisions while connected to the internet. This interconnected architecture is attracting cyber criminals to expose the IoT system to failure. Therefore, it becomes imperative to develop a system that can accurately and automatically detect anomalies and attacks occurring in IoT networks. Therefore, in this paper, an Intrsuion Detection System (IDS) based on extracted novel feature set synthesizing BoT-IoT dataset is developed that can swiftly, accurately and automatically differentiate benign and malicious traffic. Instead of using available feature reduction techniques like PCA that can change the core meaning of variables, a unique feature set consisting of only seven lightweight features is developed that is also IoT specific and attack traffic independent. Also, the results shown in the study demonstrates the effectiveness of fabricated seven features in detecting four wide variety of attacks namely DDoS, DoS, Reconnaissance, and Information Theft. Furthermore, this study also proves the applicability and efficiency of supervised machine learning algorithms (KNN, LR, SVM, MLP, DT, RF) in IoT security. The performance of the proposed system is validated using performance Metrics like accuracy, precision, recall, F-Score and ROC. Though the accuracy of Decision Tree (99.9%) and Randon Forest (99.9%) Classifiers are same but other metrics like training and testing time shows Random Forest comparatively better.

Author(s):  
Karthik R. ◽  
Ifrah Alam ◽  
Bandaru Umamadhuri ◽  
Bharath K. P. ◽  
Rajesh Kumar M.

In this chapter, the authors use various signal processing techniques to analyze and gain insights on how ECG signals for patients suffering from sleep apnea (sleep apnea or obstructive sleep apnea occurs when the muscles that support the soft tissues in the throat, such as tongue and soft palate, relax temporarily) disease vary with respect to a normal person's ECG. The work has three stages: firstly, to identify waves, complexes, morphology in an ECG which reflect the presence of the disease; second, feature extraction techniques to extract features of ECG such as duration of the wave, amplitude distribution, and morphology classes; and third, detailed clustering (unsupervised) algorithm analysis of the extracted features with efficient feature reduction methodologies such as PCA and LDA. Finally, the authors use supervised machine learning algorithms (SVM, naive Bayes classifier, feed forward neural network, and decision tree) to distinguish between ECG signals with sleep apnea and normal ECG signals.


2020 ◽  
Vol 10 (2) ◽  
pp. 1-26
Author(s):  
Naghmeh Moradpoor Sheykhkanloo ◽  
Adam Hall

An insider threat can take on many forms and fall under different categories. This includes malicious insider, careless/unaware/uneducated/naïve employee, and the third-party contractor. Machine learning techniques have been studied in published literature as a promising solution for such threats. However, they can be biased and/or inaccurate when the associated dataset is hugely imbalanced. Therefore, this article addresses the insider threat detection on an extremely imbalanced dataset which includes employing a popular balancing technique known as spread subsample. The results show that although balancing the dataset using this technique did not improve performance metrics, it did improve the time taken to build the model and the time taken to test the model. Additionally, the authors realised that running the chosen classifiers with parameters other than the default ones has an impact on both balanced and imbalanced scenarios, but the impact is significantly stronger when using the imbalanced dataset.


Electronics ◽  
2020 ◽  
Vol 9 (11) ◽  
pp. 1777
Author(s):  
Muhammad Ali ◽  
Stavros Shiaeles ◽  
Gueltoum Bendiab ◽  
Bogdan Ghita

Detection and mitigation of modern malware are critical for the normal operation of an organisation. Traditional defence mechanisms are becoming increasingly ineffective due to the techniques used by attackers such as code obfuscation, metamorphism, and polymorphism, which strengthen the resilience of malware. In this context, the development of adaptive, more effective malware detection methods has been identified as an urgent requirement for protecting the IT infrastructure against such threats, and for ensuring security. In this paper, we investigate an alternative method for malware detection that is based on N-grams and machine learning. We use a dynamic analysis technique to extract an Indicator of Compromise (IOC) for malicious files, which are represented using N-grams. The paper also proposes TF-IDF as a novel alternative used to identify the most significant N-grams features for training a machine learning algorithm. Finally, the paper evaluates the proposed technique using various supervised machine-learning algorithms. The results show that Logistic Regression, with a score of 98.4%, provides the best classification accuracy when compared to the other classifiers used.


2021 ◽  
Vol 2021 ◽  
pp. 1-35
Author(s):  
Thomas Rincy N ◽  
Roopam Gupta

Today’s internets are made up of nearly half a million different networks. In any network connection, identifying the attacks by their types is a difficult task as different attacks may have various connections, and their number may vary from a few to hundreds of network connections. To solve this problem, a novel hybrid network IDS called NID-Shield is proposed in the manuscript that classifies the dataset according to different attack types. Furthermore, the attack names found in attack types are classified individually helping considerably in predicting the vulnerability of individual attacks in various networks. The hybrid NID-Shield NIDS applies the efficient feature subset selection technique called CAPPER and distinct machine learning methods. The UNSW-NB15 and NSL-KDD datasets are utilized for the evaluation of metrics. Machine learning algorithms are applied for training the reduced accurate and highly merit feature subsets obtained from CAPPER and then assessed by the cross-validation method for the reduced attributes. Various performance metrics show that the hybrid NID-Shield NIDS applied with the CAPPER approach achieves a good accuracy rate and low FPR on the UNSW-NB15 and NSL-KDD datasets and shows good performance results when analyzed with various approaches found in existing literature studies.


A Network Intrusion Detection System (NIDS) is a framework to identify network interruptions as well as abuse by checking network traffic movement and classifying it as either typical or strange. Numerous Intrusion Detection Systems have been implemented using simulated datasets like KDD’99 intrusion dataset but none of them uses a real time dataset. The proposed work performs and assesses tests to overview distinctive machine learning models reliant on KDD’99 intrusion dataset and an ongoing created dataset. The machine learning models achieved to compute required performance metrics so as to assess the chosen classifiers. The emphasis was on the accuracy metric so as to improve the recognition pace of the interruption identification framework. The actualized calculations showed that the decision tree classifier accomplished the most noteworthy estimation of accuracy while the logistic regression classifier has accomplished the least estimation of exactness for both of the datasets utilized.


The advancement in cyber-attack technologies have ushered in various new attacks which are difficult to detect using traditional intrusion detection systems (IDS).Existing IDS are trained to detect known patterns because of which newer attacks bypass the current IDS and go undetected. In this paper, a two level framework is proposed which can be used to detect unknown new attacks using machine learning techniques. In the first level the known types of classes for attacks are determined using supervised machine learning algorithms such as Support Vector Machine (SVM) and Neural networks (NN). The second level uses unsupervised machine learning algorithms such as K-means. The experimentation is carried out with four models with NSL- KDD dataset in Openstack cloud environment. The Model with Support Vector Machine for supervised machine learning, Gradual Feature Reduction (GFR) for feature selection and K-means for unsupervised algorithm provided the optimum efficiency of 94.56 %.


2021 ◽  
Vol 7 ◽  
pp. e437
Author(s):  
Arushi Agarwal ◽  
Purushottam Sharma ◽  
Mohammed Alshehri ◽  
Ahmed A. Mohamed ◽  
Osama Alfarraj

In today’s cyber world, the demand for the internet is increasing day by day, increasing the concern of network security. The aim of an Intrusion Detection System (IDS) is to provide approaches against many fast-growing network attacks (e.g., DDoS attack, Ransomware attack, Botnet attack, etc.), as it blocks the harmful activities occurring in the network system. In this work, three different classification machine learning algorithms—Naïve Bayes (NB), Support Vector Machine (SVM), and K-nearest neighbor (KNN)—were used to detect the accuracy and reducing the processing time of an algorithm on the UNSW-NB15 dataset and to find the best-suited algorithm which can efficiently learn the pattern of the suspicious network activities. The data gathered from the feature set comparison was then applied as input to IDS as data feeds to train the system for future intrusion behavior prediction and analysis using the best-fit algorithm chosen from the above three algorithms based on the performance metrics found. Also, the classification reports (Precision, Recall, and F1-score) and confusion matrix were generated and compared to finalize the support-validation status found throughout the testing phase of the model used in this approach.


2020 ◽  
pp. 471-476
Author(s):  
Gitanjali Wadhwa ◽  
Mansi Mathur

The important part of female reproductive system is ovaries. The importance of these tiny glands is derived from the production of female sex hormones and female gametes. The place of these ductless almond shaped tiny glandular organs is on just opposite sides of uterus attached with ovarian ligament. There are several reasons due to which ovarian cancer can arise but it can be classified by using different number of techniques. Early prediction of ovarian cancer will decrease its progress rate and may possibly save countless lives. CAD systems (Computer-aided diagnosis) is a noninvasive routine for finding ovarian cancer in its initial stages of cancer which can keep away patients’ anxiety and unnecessary biopsy. This review paper states us about how we can use different techniques to classify the ovarian cancer tumor. In this survey effort we have also deliberate about the comparison of different machine learning algorithms like K-Nearest Neighbor, Support Vector Machine and deep learning techniques used in classification process of ovarian cancer. Later comparing the different techniques for this type of cancer detection, it gives the impression that Deep Learning Technique has provided good results and come out with good accuracy and other performance metrics.


Sensors ◽  
2021 ◽  
Vol 21 (16) ◽  
pp. 5426
Author(s):  
Lisa Giese ◽  
Jörg Melzheimer ◽  
Dirk Bockmühl ◽  
Bernd Wasiolka ◽  
Wanja Rast ◽  
...  

Behavioural studies of elusive wildlife species are challenging but important when they are threatened and involved in human-wildlife conflicts. Accelerometers (ACCs) and supervised machine learning algorithms (MLAs) are valuable tools to remotely determine behaviours. Here we used five captive cheetahs in Namibia to test the applicability of ACC data in identifying six behaviours by using six MLAs on data we ground-truthed by direct observations. We included two ensemble learning approaches and a probability threshold to improve prediction accuracy. We used the model to then identify the behaviours in four free-ranging cheetah males. Feeding behaviours identified by the model and matched with corresponding GPS clusters were verified with previously identified kill sites in the field. The MLAs and the two ensemble learning approaches in the captive cheetahs achieved precision (recall) ranging from 80.1% to 100.0% (87.3% to 99.2%) for resting, walking and trotting/running behaviour, from 74.4% to 81.6% (54.8% and 82.4%) for feeding behaviour and from 0.0% to 97.1% (0.0% and 56.2%) for drinking and grooming behaviour. The model application to the ACC data of the free-ranging cheetahs successfully identified all nine kill sites and 17 of the 18 feeding events of the two brother groups. We demonstrated that our behavioural model reliably detects feeding events of free-ranging cheetahs. This has useful applications for the determination of cheetah kill sites and helping to mitigate human-cheetah conflicts.


Sign in / Sign up

Export Citation Format

Share Document